Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

71–80 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#71

Post by danso »

303space wrote: post #52
lhorie wrote: post #2

Someone I know was just commenting that from convos w/ people in other companies, it seems many startups have benefitted from not being under the limelight, and thus had the chance to quietly clean up their own messes while Uber was taking all the heat from the media.

Does anyone else find this whole thing more than a bit hypocritical? Lyft is always telling you they are the better/ethical/woke ridesharing option - now their employees are reporting a culture of abusing customer privacy. I wish they had taken a look at their own practices before running million dollar ad campaigns full of celebrities celebrating their ‘wokeness’.

Much of the criticism against Uber concern top-level decisions, such as the creation and use of "Greyball", or actions and decisions from Kalanick himself and other top executives. Lyft maybe deserves blame for not building better and more automated audit systems and policies after knowing that these lookups could be abused.

Re: Former employees say Lyft staffers spied on passengers

#72

Post by dragonwriter »

jancsika wrote: post #57
joshuamorton wrote: post #6

Earlier quoted context omitted.

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

> At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You're seriously arguing that cryptography has no technical means for a driver to send an unrepudiatable attestation of intent to drive from A to B at time C to an anonymous passenger? And that an ombudsman armed with driver GPS data c…

> You're seriously arguing that cryptography has no technical means for a driver to send an unrepudiatable attestation of intent to drive from A to B at time C to an anonymous passenger? And that an ombudsman armed with driver GPS data cannot compare the attestation to the GPS data and instead needs identification data on the passenger in order to verify whether the driver went to the correct drop-off?

There are at least three things you need here:

(1) the agreed trip, and

(2) that the passenger showed up and got in,

(3) that the passenger did not make some demand that ended the driver's obligation to make the agreed trip en route.

Re: Former employees say Lyft staffers spied on passengers

#73

Post by s73ver_ »

eponeponepon wrote: post #43
joshuamorton wrote: post #41

Earlier quoted context omitted.

>"Hey, this isn't the right place. Take me where you said you would please." The app still charges you. You need a way to get a refund from Lyft , not from the driver. >"Hey gran, I'm going to be late for lunch, the darn taxi driver hasn't turned up. I'm calling another firm - guess I'll see you when I get there." The app still charges you. You need a way to get a refund from Lyft , or alternatively, to refute the lo…

> Is your issue with Lyft's business model, or my > comments about encryption? Both, as it goes :) I think you're using the word need in a much more narrow context than I am. Without Lyft/Uber/whoever convincing their customers that they're needed, there is no need for the data to be recorded in the first place. And most of the time, you'd still get to Gran's when you said you would.

I know very few people who would tolerate not being able to get a refund. I know many who would end up giving up fighting for it, but would never use the service again.

And, lets bring it up to something more relevant. The driver steals from or assaults a passenger. Having that data would be key in actually bringing charges against the driver.

Re: Former employees say Lyft staffers spied on passengers

#74

Post by s73ver_ »

mattdodge wrote: post #27
ageitgey wrote: post #24

Earlier quoted context omitted.

> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?

Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.

I absolutely would say it would, especially where there's a very good chance that the home and work addresses are part of that list, and the idea that someone would use a database like that to spy on an ex and harass and/or assault them is an actual thing that happens.

Re: Former employees say Lyft staffers spied on passengers

#75

Post by nradov »

opportune wrote: post #63
ddinh wrote: post #58

Earlier quoted context omitted.

Just curious - why is looking up yourself an offense?

You don't really own your medical record, also doctors add notes to your medical record that you may not like. For example your medical record may say that you don't follow up with medication, abuse drugs, have psychiatric/personality problems, etc. which patients could be sensitive about.

That's not true. In the US at least as an adult you have a legal right to see everything in your medical record.

Re: Former employees say Lyft staffers spied on passengers

#76

Post by dragonwriter »

ddinh wrote: post #58
pookeh wrote: post #54

Earlier quoted context omitted.

Here in Canada if you have access to the central medical records you can look up anyone but (a) if you are not a doc and are not assigned to the case or (b) you are looking up yourself or a family member, you immediately get a call and get fired on the spot. (Source: Wife works at the hospital and has seen some people get fired shortly after unauhorized access.)

Just curious - why is looking up yourself an offense?

Abuse of employer resources for personal purposes, probably.

Re: Former employees say Lyft staffers spied on passengers

#78

Post by dragonwriter »

nradov wrote: post #75
opportune wrote: post #63

Earlier quoted context omitted.

You don't really own your medical record, also doctors add notes to your medical record that you may not like. For example your medical record may say that you don't follow up with medication, abuse drugs, have psychiatric/personality problems, etc. which patients could be sensitive about.

That's not true. In the US at least as an adult you have a legal right to see everything in your medical record.

And trying to exercise that right by using tools you have access to as an employee of your own health care provider rather than going through the proper channels that any other patient goes through to request such access (which involve the employer having documentation of the request, and auditability as to the purpose of any access involved in serving that request), is likely to violate internal procedures designed both to protect PHI and assure that all access is within job function.

Re: Former employees say Lyft staffers spied on passengers

#79

Post by mmanfrin »

The screenshots from the leaker mention that they are using "redshift", which is the name of Amazon's RDB product. Which means this is about people who have access to the database. This is unsurprising that they could access customer data given access to their database. I'm not sure how you prevent this without preventing access to the db (and there are legitimate reasons people within the company would have access -- DBAs, Engineers who are writing direct queries, etc).

Not defending people accessing PII, but just saying there are legitimate reasons why someone could have access.

Re: Former employees say Lyft staffers spied on passengers

#80

Post by throwawaylyfty »

I worked there. I was an engineer and definitely needed access to these data. Fraud and abuse is constantly evolving and touches every part of the business. Everything was audited and I never saw or heard of a single abuse of access. Privacy was talked about seriously at onboarding and other trainings. I have no doubt if somebody was caught abusing this they’d be fired.
Post reply on HN